Privacy Policy

Instructions

  • Please read the Terms of Use and Privacy Policy carefully. If you disagree with any of the provisions, you must discontinue your use of this website and all other Activate online platforms.

1. EFFECTIVE DATE

1.1. This Privacy Policy shall apply with effect from 11th February 2022.

1.2. This Privacy Policy supersedes all prior versions from the said effective date.

2. PARTIES

2.1. This Privacy Policy is a contract between each User and the Firm governing the use of Activate.

3. DEFINITION OF TERMS

In this Privacy Policy unless otherwise expressly indicated or the context otherwise requires:

3.1. “Authorised Representative” means any person who has legal capacity and explicit consent to act on behalf of a User.

3.2. “Cookie” refers to a text file containing data, which may include Personal Data, that is created by a website and stored on a website visitor’s device to identify the visitor and to keep track of the visitor’s activities and preferences so as to improve online experience and enhance security.

3.3. “Data Controller” has the meaning ascribed in the Data Protection Act (No. 24 of 2019) (as modified from time to time).

3.4. “Data Processor” has the meaning ascribed in the Data Protection Act (No. 24 of 2019) (as modified from time to time).

3.5. “Data Subject” has the meaning ascribed in the Data Protection Act (No. 24 of 2019) (as modified from time to time).

3.6. “Firm” has the meaning ascribed in the Terms of Use.

3.7. “Personal Data” has the meaning ascribed in the Data Protection Act (No. 24 of 2019) (as modified from time to time).

3.8. “Secret Data” means any data which, by its nature, should not be disclosed to a third party for example PIN numbers, passwords and trade secrets.

3.9. “Sensitive Personal Data” has the meaning ascribed in the Data Protection Act (No. 24 of 2019) (as modified from time to time).

3.10. “Subscriber” has the meaning ascribed in the Terms of Use. “User” has the meaning ascribed in the Terms of Use.

3.11. “User” has the meaning ascribed in the Terms of Use.

4. INTERPRETATION

4.1. This Privacy Policy is supplemental to the Terms of Use and shall be read as part and parcel of the Terms of Use. In the event of any conflict between the Privacy Policy and the Terms of Use the provisions of the Privacy Policy shall prevail.

4.2. Unless otherwise expressly indicated or the context otherwise requires, capitalized terms contained in this Privacy Policy have the meaning ascribed in the Terms of Use and Privacy Policy.

4.3. For purposes of this Privacy Policy, each User (including his/her Authorised Representative) is a Data Subject.

4.4. For purposes of this Privacy Policy, the Firm is the Data Controller and is also a Data Processor.

5. CAPACITY

5.1. Activate is intended for use within the Republic of Kenya by persons aged eighteen (18) years and above. By using Activate, you warrant that you are an adult.

5.2. If you are acting as an Authorised Representative on behalf of a User who is a corporate entity, or as an agent on behalf of a User who is the principal, you warrant and undertake that you have legal authority and explicit consent from the User to consent to this Privacy Policy, to disclose Personal Data relating to the User, and to exercise the rights of the User as set out in this Privacy Policy or provided at law. In this case, we reserve the right:

(a) to confirm through such means as may be necessary or expedient that you are indeed authorised to act on behalf of the User; and

(b) to withhold access to Activate until such time as we receive such confirmation to our reasonable satisfaction.

6.1. By accessing, registering for or using Activate in any manner, you agree that you have read, understood and voluntarily accept the terms of this Privacy Policy.

6.2. By consenting to this Privacy Policy, you also expressly consent to the following:

(a) Collection transmission processing storage and use of data (including Personal Data) for each of the purposes set out in this Privacy Policy.

(b) Transfer, processing and storage of data (including Personal Data) outside Kenya.

(c) Storage of data (including Personal Data) in raw form after expiry of the retention period set out in this Privacy Policy either for compliance purposes or for reference in resolution of subsisting or potential complaints or disputes.

7. PURPOSE

7.1. General Purpose: Personal Data will be collected, transmitted, processed, stored and used for the purposes set out below:

(a) Data handling in such manner as may be approved by the User or his/her Authorised Representative;

(b) Performance of the contract constituted in the Terms of Use and this Privacy Policy;

(c) Statutory compliance;

(d) Protection of rights or legitimate interests of any User, the Firm, the Firm’s service providers, or third parties;

(e) Resolution of any complaint or dispute between the User and the Firm;

(f) Issuance of direct marketing communication to the User.

7.2. Purpose of Cookie Data: Our website and its third-party extensions use strictly necessary and functional Cookies for security reasons and to perform essential functions.

7.3. Our Commitment: Save as set out in this Privacy Policy, we shall not handle your Personal Data in a manner that is incompatible with the specified purposes nor re-sell or disclose your Personal Data other than:

(a) With your prior consent; or

(b) As required by law or pursuant to a court order.

8. NATURE OF PERSONAL DATA HANDLED

8.1. Cookie Data:

(a) Cookie data collected, transmitted, processed and stored by our website and its extensions includes HTTP protocol elements, referring URL, user agent, device used, operating system, browser type, IP address, geographical location, links clicked, login credentials and login frequency. A User’s IP address could potentially be regarded as Personal Data.

(b) Collection of Cookie data is mandatory for Users who visit our website.

8.2. Subscription Account Data:

(a) The Personal Data collected in connection with subscription to Activate plans includes the Subscriber’s email address, which is required for purposes of account creation.

(b) Collection of subscription account data is mandatory for Subscribers who sign up for any Activate plan.

8.3. Invoicing Data:

(a) The Firm may request Subscribers to submit such Personal Data as may be required under the Value Added Tax Act (No. 35 of 2013) and subsidiary legislation (as modified from time to time) in connection with invoicing for Activate paid plans.

(b) If requested, collection of invoicing data will be mandatory for Subscribers to Activate paid plans.

8.4. Payment Data:

(a) The Personal Data collected from Subscribers in connection with payments is the Subscriber’s phone number.

(b) Collection of payment data is mandatory for Subscribers who subscribe to Activate paid plans.

8.5. Suggestion-Related Data:

(a) Users are invited to voluntarily submit suggestions to help us improve Activate content and features. The Personal Data collected from Users in connection with suggestions includes the User’s email address.

(b) Collection of suggestion-related data is optional. Suggestions may be submitted either anonymously or through an account created by the User in the My Query portal. We recommend that suggestions be submitted anonymously.

8.6. Other Data Sets:

(a) Other Personal Data collected from Users in connection with administrative support, technical support, complaints and all other matters relating to use of Activate includes the User’s name, email address, phone number and IP address.

(b) Collection of such data is mandatory for any User who contacts the Firm for the stated reasons.

9. USER RIGHTS AND RESPONSIBILITIES

9.1. You have a right:

(a) To access and update your Personal Data;

(b) To request for erasure of your Personal Data;

(c) To have inaccurate Personal Data rectified;

(d) To restrict or object to processing of your Personal Data, and to withdraw consent to processing of Personal Data, provided that such actions shall not affect prior processing;

(e) To receive your Personal Data in a structured, commonly used and machine-readable format;

(f) To transmit your Personal Data to another Data Controller or Data Processor;

(g) If technically possible, to arrange for direct transfer of your Personal Data to another Data Controller or Data Processor.

9.2. You are responsible for ensuring that your Personal Data remains up to date at all times.

9.3. Upon receipt of a data erasure or rectification request, we will take all reasonable steps to inform the concerned third party service providers who act as Data Processors to update their records accordingly.

9.4. Restriction on Disclosure of Sensitive Personal Data or Secret Data: Users are strictly prohibited from disclosing Sensitive Personal Data and Secret Data through Activate because our IT systems are not designed to process and store such data. We only require a User to key in his/her mobile money PIN number on his/her mobile device to facilitate payment processing where the subscription transaction has been manually initiated by the User on our website. In all other instances, Users are solely responsible for any Sensitive Personal Data or Secret Data that they choose to disclose, and the Firm accepts no liability for any data privacy violations in this regard.

9.5. Caution on Disclosures in Public or Group Media: You acknowledge that viral dissemination of information via publicly-accessible communication channels or group forums (including social media and conferencing platforms) is in perpetuity and not under the absolute control of the Firm. Accordingly, the Firm shall not be liable for any unauthorized disclosure or use of data (including Personal Data) that you may submit through any publicly-accessible communication channel or group forum.

9.6. Caution on Use of Third Party Resources: Where links or references to third-party websites or other resources are provided, please note that such third-party resources have independent privacy policies and practices that are not within our control. Caution is advised when sharing data with third parties.

10. CONSEQUENCES OF DATA HANDLING RESTRICTIONS

10.1. General Consequences: If you –

(a) Withhold all or any part of the requested Personal Data; or

(b) Withhold consent to this Privacy Policy; or

(c) Withdraw consent to, or restrict, processing of Personal Data;

(d) Request for erasure of Personal Data;

your ability to access or use all or part of Activate or ancillary services may be restricted or completely denied.

10.2. Effects on Subscriptions: If a Subscriber requests for restriction or objection to processing of Personal Data, the Firm will have no recourse but to discontinue the Subscriber’s use of Activate subscription plans in order to honour the request. In such event:

(a) The identified account(s) that created on Activate will be cancelled without further notice to the Subscriber; and

(b) Any subscription fees paid by the Subscriber will be deemed to have been immediately forfeited even though the subscription may be unutilized or partially utilized at the time of cancellation of the account(s).

10.3. Effects of Cookie Privacy Controls: If you access our website, a Cookie may be stored in your browser or device either temporarily (until you end the session) or permanently (until the Cookie expires or is deleted). Most browsers and devices allow website visitors to block or delete Cookies. Blocking Cookies may adversely affect website functionality.

10.4. Reserved Right: Notwithstanding your rights aforementioned, we reserve the right to retain indefinitely certain data sets (including Personal Data) for compliance purposes or for reference in resolution of existing or potential complaints or disputes. In this case:

(a) We will notify you of the nature of Personal Data retained; and

(b) Processing of the retained Personal Data will be restricted.

11. ACCESS TO DATA; ACCOUNT MANAGEMENT

11.1. Users who have created an account in an Activate platform can access their Personal Data by logging in to the respective account.

11.2. We require Users to manage their Activate accounts in a manner that will not expose their data or our systems to undue risks. For more information on Privacy and Security Guidelines please refer to the Frequently Asked Questions (FAQs).

12. RESPONSE TIME; APPLICABLE FEES

12.1. A data porting request will be addressed within thirty (30) days from the date of receipt of the request. This period may be extended depending on the complexity and volume of pending data porting requests.

12.2. All other requests relating to exercise of your rights aforementioned will be addressed within seven (7) days from the date of receipt of the request unless a delay is occasioned by unexpected circumstances in which case we will inform you of the delay.

12.3. Requests relating to exercise of your statutory rights as a Data Subject will be attended to free of charge.

13. AUTOMATED DECISION-MAKING

13.1. We do not deploy automated processing of Personal Data for purposes of decision making.

14. DATA RETENTION

14.1. Personal Data on completed transactions shall be retained for a minimum of seven (7) years. Thereafter, the Personal Data may be anonymised or erased unless the retention period is extended at our discretion:

(a) For compliance purposes;

(b) For reference in resolution of subsisting or potential complaints or disputes.

14.2. Communication relating to suggestions and technical support queries will be retained in raw form for a minimum of ninety (90) days after the data will either be erased or anonymised and archived indefinitely.

15. DATA PROTECTION SAFEGUARDS

15.1. To prevent unauthorised access to Personal Data, we have put in place various safeguards to ensure security and data privacy in accordance with the laws of Kenya and industry standards. These measures include:

(a) Deployment of firewalls;

(b) Encryption of data in transit;

(c) Storage of data back-ups;

(d) Monitoring and reviews.

16. DATA SHARING

16.1. Data Sharing: User data (including Personal Data) is accessible to the Firm’s third party service providers who collect, transmit, process and store such data to perform certain functions on our behalf including web hosting, data archiving, security, content management, subscription management, payment processing, access control, customer management, communication, and general administration.

16.2. Safeguards: We adopt various approaches to ensuring that our service providers maintain adequate data protection safeguards including selecting service providers that comply with appropriate laws and that have adopted suitable safeguards such as:

(a) Not storing Personal Data or Secret Data in their own servers; and/or

(b) Encrypting Personal Data in transit and at rest; and/or

(c) Attaining compliance certification for physical and network security; and/or

(d) Complying with the European Union (EU) Regulation 2016/679 commonly referred to as the General Data Protection Regulation or GDPR.

17. TRANSFER OF PERSONAL DATA OUTSIDE KENYA

17.1. Personal Data is transmitted to, processed and stored in servers situated in various locations worldwide. Our service providers may share Personal Data with other third parties including affiliated companies and their service providers.

17.2. The safeguards set out in clause 16.2 apply to Personal Data transferred outside Kenya.

18. COMMUNICATION

18.1. Users who maintain a subscription to any Activate product or social media group may from time to time receive emails or messages that contain system notifications or account management communication. For as long as the subscription remains active, a User cannot opt out from receiving such communication.

18.2. Users who subscribe to Activate Newsletter or any Activate social media group may receive direct marketing communication including updates to Activate catalogues. Users are at liberty to opt out from receiving such communication by clicking on the “unsubscribe” link provided in any of the relevant emails or by leaving the social media group.

19. REQUESTS; COMPLAINTS

19.1. If you would like to contact us about anything set out in this Privacy Policy, or if you have a complaint, please submit a ticket through the Tech Support portal.

Revisions:

1st October 2021: Version 1

11th February 2022: Version 2